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1. Overview 


Population Estimates are produced by updating figures from the most recent census 
with information from other sources, one of which is the NHS Central Register 
(NHSCR). 


Data from NHSCR is used in the following population estimates publications: 
e Mid-Year Population Estimates 
e Special Area Population Estimates 
e Estimates of Special Populations 


The NHSCR Governance Board commissioned National Records of Scotland (NRS) to 
prepare a report, in line with guidance from the Information Commissioner’s Office 
(ICO) and Caldicott Guidance on Health Care Confidentiality which addresses: 
e privacy issues in relation to the transfer and use of data from the NHSCR in 
generating Population and Migration Estimates; and 
e safeguards in place to protect personal information. 


This is a summary of the full report. It is not possible to publish the full report as it 
contains potentially disclosive material. 


2. Population and Migration Estimates - The Process 


Background 


The data and steps to obtain population and migration estimates are summarised in 
the following steps: 


1. start with the previous year’s population 

2. Subtract the previous year’s armed forces stationed in Scotland 
3. subtract the previous year’s prison population 

4. age-on the population by one year 

5. add in the current year’s armed forces stationed in Scotland 

6. add in the current year’s prison population 

7. add births 

8. subtract deaths 

9. adjust for migration* 

10. estimated population for current year. 


*Add net migration which includes in-migrants from England and Wales, N. Ireland 
and overseas and out-migrants to England and Wales, N. Ireland and overseas. 
This also includes movements to and from the armed forces (including dependants) 
by the civilian population, rounding adjustments and estimates of asylum seekers 
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The estimated population from the 2001 Census is the starting point for the current 
series of mid-year population estimates. Note that both census and mid-year 
population estimates define the estimated population as follows: 


“The estimated population of an area includes all those usually resident there, 
whatever their nationality. Students are treated as being resident at their term-time 
address. Members of UK and non-UK armed forces stationed in Scotland are 
included; UK forces stationed outside Scotland are excluded. Short-term 
international migrants, who stay for less than 12 months, are excluded.” 


Note that both the mid-year population estimates and the census count long-term 
migrants in their place of residence. Long-term international migrants are defined as 
people that change their country of residence for 12 months or more. 


Data Sources 


Both data on births and deaths are obtained from the compulsory civil registration 
systems. The Population and Migration Statistics team receives data on live births by 
sex for the period from 1 July of the previous year to 30 June of the current year. The 
data refer to the date of the event rather than the date of registration. 


Births are added to the population at age zero and are allocated to the area of usual 
residence of the mother. 


Deaths are subtracted from the mid-year population by age and sex at the area of 
usual residence of the deceased. In order for this to work correctly, the age at death is 
calculated to be the age that the deceased person would have been on 30 June. No 
adjustments are made for non-resident deaths. 


Migration is the most difficult component of population change to estimate, as there is 
no comprehensive system which registers migration in the UK, either moves to or from 
the rest of the world, or moves within the UK. Migration estimates are derived from 
three key sources of data: 


e The National Health Service Central Register (NHSCR), to calculate moves 
between NHS Board areas within the UK. 

e Migration at Council area and below are estimated using anonymised data from 
the Community Health Index (CHI). 

e The International Passenger Survey (IPS) provides information on moves into 
and out of Scotland with an origin or destination outside UK. 


The Population and Migration Branch of NRS receive: 
e Monthly extracts of patients moving between NHS Board areas from NHSCR 
Dumfries. 
e Quarterly total number of people migrating to England and Wales from Scotland 
and raw data extracted from NHSCR Southport from ONS. 
e Quarterly total number of people migrating to Northern Ireland from Scotland 
from the Northern Ireland Health and Social Care (NIHSC) agency. 
Statutory Requirements, Privacy Issues, Retention and Dissemination 


Information about the use of NHSCR data in the production of Population and 
Migration Statistics is provided to data subjects on the NHSCR section of the NRS 
website. 


Subjects consent in using the data is not sought for two reasons: 
e the scale of the data collection; and 
e the pursuit of explicit consent may result in incomplete datasets and bias. 
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The resulting statistics are published at an aggregate level only and so there are no 
adverse effects on individual data subjects from the use of this data. Transmission, 
storage and access to data comply with the Data Protection Act 1998, which covers 
data confidentiality. 


The subset of NHSCR demographic extracts and other NHSCR data files are kept for 
as long as required (which is permitted by the Data Protection Act 1998 because 
population estimates comply with the requirements of the research exemption). 


A strict Statistical Disclosure Control Policy is in place to safeguard the individual’s 
privacy in all of our statistical publications. This policy was developed in consultation 
with the Office of Chief Statistician and the Office for National Statistics (ONS). 


The main method of dissemination is through the internet. None of the published 
outputs contains personal identifying information. 


3. Security 


All staff employed in National Records of Scotland: 


e Undergo strict security pre-employment checks (Baseline Personnel Security 
Standard outlined in the Her Majesty's Government (HMG) Security Policy 
Framework). 

e Are continuously trained and reminded about security, data handling and 
disclosure issues. 

e Are bound to: 

- The Civil Service Code. 

- Census legislation. 

- The Computer Misuse Act; Freedom of Information (Scotland) Act; and the 
Copyright, Design and Patents Act. 

- Staff using information processing facilities are also subject to the IT Code of 
Conduct. 

e Must comply with NRS Information Security, which is approved by the Registrar 
General and is reviewed on an annual basis each June. 


Access Control Policies (ACPs) control the access to information. They apply to any 
area or system where sensitive or protectively marked data is stored. ACPs apply to all 
staff. 


Access to IT equipment and systems is strictly controlled and all NRS Buildings are 
secured in accordance with the guidance in the HMG Security Policy Framework. 


NRS removable media are encrypted to the HMG approved standard. 


NRS has a strict incident management and vulnerability policy for which any security or 
data misuse must be documented and communicated to Senior Management. 


Policies, Documentation and Structure 


Information Security and Information Assurance in NRS are in line with the: 
e HMG Security Policy Framework, 
e Communications Electronic Security Group Information Assurance (CESG IA) 
Standards and Good Practice Guides. 


These standards are closely aligned to ISO 27001. 
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The organisational structure to protect data privacy and security in each project is 
based on the Information Asset Owners. They are senior individuals involved in the 
running of each project that control and grant access to data only to those that need it. 
They must report to the Senior Information Risk Owner any security issue or privacy 
concern, who in turn must report to the Accounting Officer, one of the senior officials in 
NRS. 


In NRS, documents and systems are assessed to decide if they must be labelled as 
protected information. Protectively marked information are subject to internal policies, 
which are audited on a regular basis, that takes confidentiality, integrity and availability 
into account and provide a detailed understanding of the risks associated with each 
system so that individuals can make informed decisions on whether they are suitable 
for storing data. Those policies are audited on a regular basis. 


NRS comply with the Data Protection Act and are registered with the Information 
Commissioner Office’s Data Protection Public Register under registration number 
Z2886501. 


Frequent audits of systems and processes are carried out to ensure compliance with 
the security policies and procedures. 


Finally, to counteract interruptions to business activities and to protect critical business 
processes from the effects of major failures of information systems or disasters, NRS 
have defined business continuity plans, procedures, roles and responsibilities. 


6 
© Crown Copyright 2013 


